Sandbox
Sandbox
Shell commands the agent runs go through the sandbox. On Linux that sandbox is Bubblewrap. PARI does not fall back to running the command as you.
Linux Bubblewrap
auto is the default. On Linux it selects Bubblewrap. If bwrap is not installed in /usr/bin, /usr/local/bin, or /bin, the command fails with an install hint. A bwrap binary checked into the repository is ignored.
| Rule | What it means |
|---|---|
| Writable mount | The workspace is the only writable directory. System paths are read-only. |
| Git metadata | .git inside the workspace is read-only from the sandbox. |
| Hidden credentials | ~/.ssh, ~/.aws, ~/.gnupg, shell rc files, .netrc, and .git-credentials are masked when they would otherwise be visible. |
| Host environment | The sandbox starts from a clean environment. Variables whose names look like KEY, TOKEN, SECRET, or PASSWORD are not copied in. |
| Network | The host network is off unless the command is a single package install. |
| Time limit | A command is killed when it exceeds its timeout. The result is marked timed out. |
Package installs
One package-install command may use the network. A chained command may not. pip install requests can reach the network. pip install requests; curl https://example.com cannot.
The allowed tools are pip, pip3, npm, pnpm, yarn, cargo, poetry, and uv. The allowed subcommands are install, add, update, fetch, and sync. Other network, a writable .git, and secret directories wait for a permission rule or a prompt.
Other systems
| Mode | Status |
|---|---|
auto | Bubblewrap on Linux. On any other OS, startup of a command reports that sandbox support is coming soon. |
bwrap | Bubblewrap. This is the Linux backend. |
seatbelt | macOS Seatbelt is not available yet. |
cloud | The E2B cloud sandbox is not available yet. |
none | Unsandboxed execution is not available. PARI will not run the command on the host. |
Set the mode for one launch with --sandbox bwrap, or for the shell with PARI_SANDBOX.
Check before a task
pari-cli --dry-runOn Linux this resolves the sandbox before a turn starts. On macOS and native Windows the same command reports that the sandbox is not available, which is the expected result today.
Next
- Permissions →
Built-in rules, rules you write, and the prompt when a command needs more.
- Install →
Install Bubblewrap and confirm the dry run.
- Troubleshooting →
Fix a missing bwrap binary or a refused command.